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Amendments to the Claims: 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 



Listing of Claims: 



1 . (Currently Amended) A system for analyzing and monitoring internet traffic, 
comprising: 

a relational database; and 



a log engine that processes log files received from at least one internet server 
and stores data processed from the log files in the relational database; fmd 

a report engine that generates reports based on the processed data stored in 
the relational database 

wherein the lo g engine, when new log file data is present in the log file, 
processes said new log file data and determines an "end of file" location on the log file, and, 
when new log file data is not present in the log file, periodically checks the log file at 
predetermined time intervals to check for new log file data, and commences processing of 
any new log file data at a most recent determined "end of file" location on the log file . 
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2. 



(Original) The system of claim 1, wherein the relational database comprises a 



plurality of hash tables. 



(Original) The system of claim 1, wherein the plurality of tables comprise: 



a visitor table that stores traffic information generated by a visitor to an 



internet site hosted by the at least one internet server; and 

a plurality of data tables, wherein each data table stores records related to a 
respective parameter. 



4. (Original) The system of claim 3, wherein the visitor table comprises at least 
one pointer to at least one record stored in at least one of the data tables. 



5. (Original) The system of claim 3, wherein the respective parameters comprise: 



domain names from which the visitor originated; and 



web browsers used by the visitor; and 



other internet sites that referred the visitor to the internet site. 
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6. (Currendy Amended) A system for analyzing and monitoring internet traffic 
generated by visitors to at least one internet site hosted by at least one internet server, 
comprising: 

a visitor centric database; and 

a log engine that receives log files from the at least one internet server, processes 
hits logged in each log file, and stores traffic data derived from the hits in the visitor centric 
database, wherein the visitor centric database associates the traffic data derived from the hits 
with a visitor that generated the hit; and 

a report engine that generates reports using the traffic data stored in the visitor 
centric database 

wherein the log engine, when new log file data is present in the log file, processes 
said new log file data and determines an "end of file" location on the log file, and, when new log 
file data is not present in the log file, periodically checks the log file at predetermined time 
intervals to check for new log file data, and commences processing of any new log file data at a 
most recent determined "end of file" location . 

7. (Original) The system of claim 6, wherein the visitor centric database comprises a 
plurality of hash tables. 
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8. (Original) The system of claim 6, wherein the plurality of hash tables comprise: 
a visitor table that stores traffic information derived from the hits, wherein the 

visitor table contains a unique visitor record for each visitor; and 

a plurality of data tables, wherein each data table stores data related to a respective 
non-unique parameter. 

9. (Original) The system of claim 8, wherein the visitor table comprises at least one 
pointer to at least one record stored in at least one of the data tables. 

10. (Original) The system of claim 8, wherein the respective non-unique parameters 
comprise: 

domain names from which the visitors originated; 
web browsers used by the visitors; and 

other internet sites that referred the visitors to the at least one internet site. 

13 

(Original) The system of claim 6, wherein the log engine comprises a database 
buffer that temporarily stores the traffic data derived from the hits logged in the log files. 
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m 

(Original) The system of claim 11, wherein the log engine further comprises a 
database updater that transfers the traffic data temporarily stored in the database buffer to the 
visitor centric database. 

\% 

)Z. (Original) The system of claim 12, wherein the database updater sorts the traffic 
data temporarily stored in the database buffer before transferring the traffic data to the visitor 
centric database. 

^X. (Original) The system of claim 6, wherein the log engine comprises a log parser 
that reads log lines in the log files, and separates each log file into individual fields. 

n 

(Currendy Amended) The system of claim 44 6, further comprising a report 
engine that generates reports using the traffic data stored in the visitor centric database wh^ew 
the log parser is adapted to process the log linco in real time ao each hit is logged to a log file . 

If 

^Artf (Original) The system of claim 6, wherein the log engine is configured to process 
hits from multiple internet sites that are logged to a single log file. 
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yi. (Original) The system of claim 6, wherein the log engine comprises a website 
identifier that identifies a source of each hit. 



w 

(Original) The system of claim 8, wherein the log engine comprises a visitor 
identifier that determines if a hit originates from a new visitor or an existing visitor. 



XL \\ 

(Original) The system of claim wherein the visitor identifier is adapted to 
create a new visitor record if a hit originates from a new visitor. 



?7 

^2tf (Original) The system of claim 6, wherein the log engine comprises a domain 
name system (DNS) resolver that determines host and domain information for each visitor. 

3? 37 

JXC. (Original) The system of claim^tf, wherein the DNS resolver utilizes reverse DNS 
resolution to determine the host and domain information for each visitor. 



(Original) The system of claim 6, wherein the log engine is adapted to process e- 
commerce log files that contain information on money spent by a visitor. 



7 



•Serial No. 09/679,297 Docket No. QSI-001 

Amdt. dated March 9, 2004 

Reply to Office Action of October 23, 2003 

n \<\ 

,25? (Currently Amended)) The system of claim wherein the report engine is 

adapted to generate reports that correlate money spent by a visitor to any other parameter of the 
traffic data. 

(Currently Amended) The system of claim 23^5", wherein the report engine is 
adapted to generate a top products report that ranks products purchased by visitors based on 
revenues generated by the products. 

20 It 

,2*>. (Currendy Amended) The system of claim 22^£ wherein the report engine is 
adapted to generate at least one of a totals report, product tree report, regions report, and top 
scores report. 

2\ |f ? 

^26T (Currendy Amended) The system of claim ($\%. wherein the report engine is 
adapted to generate a report that displays a value of at least one traffic data parameter over at 
least one predetermined time period. 

*2rT (Original) The system of claim^f, wherein the report comprises a snapshot report 
in which the at least one predetermined time period comprises seven consecutive 24 hour time 
periods. 
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21 21 

(Original) The system of claim^t), wherein the report comprises an hourly graph 
report in which the at least one predetermined time period comprises a plurality of consecutive 
one hour time periods. 

24 11 

(Currendy Amended) The system of claim 6 ^ wherein the report engine is 
adapted to generate a top pages report that ranks website pages based on number of visitors to 
the website pages. 

2 5 # 

(Original) The system of claim,29C wherein each entry in the top pages report 



comprises a link for accessing additional information about a respective website page. 

2k 11 

(Currendy Amended) The system of claim 6 ^ wherein the report engine is 
adapted to generate a search engine report that displays a list of most used search engines. 

27 If 

(Currendy Amended) The system of claim wherein the report engine is 
adapted to generate a top domains report that displays regional and network information about 
the visitors. 
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(Currently Amended) The system of claim 6 Jd£ wherein the report engine is 
adapted to generate a browser tree report that ranks internet browsers based on which internet 
browsers are used most by visitors to a website. 

y 2% 

jyf. (Original) The system of claim ^ wherein each internet browser entry in the 
browser tree report includes a link for accessing information about different versions of a 
respective internet browser. 

3D 17 

2& (Currently Amended) The system of claim 4^ wherein the report engine is 
adapted to generate a top entrances report that ranks starting points of visitors to a website 
based most used starting points. 

3\ ,7 

^h€. (Currently Amended) The system of claim 6^5, wherein the report engine is 
adapted to generate at least one of a summary report, a daily graph report, a monthly graph 
report, a top servers report, a file types report, a status/ errors report, a posted forms report, a 
top referrals report, a top keywords report, a referral tree report, a domain tree report, a top 
countries report, a platform tree report, a top combos report, a top exits report, a click through 
report, a depth of visit report, a length of visit report, and a usernames report. 
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*2fT. (Currently Amended) The system of claim wherein the report engine 

comprises: 

a template module that stores report templates; 

a session parser that receives report requests from the at least one server, and 
determines a type of report requested, data needed to generate a requested report and a format 
for the requested report; 

an authenticator that receives an identity of a report requester from the session 
parser, and verifies that the report requester has permission to view a requested report; 

a data query module that receives authentication information from the 
authenticator, and that queries the database for data needed to generate the requested report if 
the report requester has permission to view the requested report; and 

a format output module that receives the data needed to generate the requested 
report from the database, retrieves templates for the requested report from the template module, 
creates the requested report, and delivers the requested report to the report requester. 

33 31 

(Original) The system of claim^ wherein the template module also stores at least 
one dictionary. 
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iH 33. 

(Original) The system of clainv2f£ wherein the format output module is adapted 
to create the requested report in a selectable language using the at least one dictionary. 

40. (Currently Amended) A system for analyzing and monitoring internet traffic 
generated by visitors to at least one internet site hosted by at least one internet server An article 
of manufacture , comprising: 

a computer usable medium having computer readable program code embodied 
therein for analyzing and monitoring internet traffic generated by visitors to at least one internet 
site hosted by at least one internet server, the computer readable program code in the article of 
manufacture comprising: 

means computer readable program code for receiving log files from the at 
least one internet server; 

means computer readable program code for processing hits logged in each 

log file by: 

initiating a process loop when new data is present in the log file, 
during which the new data is processed and an "end of file" location is determined for use as a 
starting point for subsequent new data processing, and 

initiating a wait loop when new data is not present in the log file, 
wherein the wait loop delays data processing for a predetermined time interval before checking 
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for new data in the log file : 



means computer readable program code for storing traffic data derived 



from the hits in a database; and 



means computer readable program code for associating the traffic data 



derived from the hits and stored in the database with a visitor that generated the hitraftd 



41 . (Currently Amended) The system article of manufacture of claim 40, wherein the 
database comprises a plurality of hash tables. 

42. (Currently Amended) The system article of manufacture of claim 41, wherein the 
plurality of hash tables comprise: 

a visitor table that stores traffic information derived from the hits, wherein the 
visitor table contains a unique visitor record for each visitor; and 



means for generating reports using the associated traffic data stored in the 



database . 



a plurality of data tables, wherein each data table stores data related to a respective 



non-unique parameter. 
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43 . (Currently Amended) The system article of manufacture of claim 42, wherein the 
visitor table comprises at least one pointer to at least one record stored in at least one of the data 
tables. 

J$ (Currently Amended) The system article of manufacture of claim 40, further 
comprising buffer means computer readable program code for temporarily storing the traffic 
data derived from the hits logged in the log files. 

Jft. (Currendy Amended) The system article of manufacture of clain>4< wherein the 
storing means computer readable program code for storing traffic data derived from the hits in a 
database comprises database update means computer readable program code for transferring the 
temporarily stored traffic data temporarily stored in the buffer means to the database. 

(Currendy Amended) The system article of manufacture of claim^£ wherein the 
database update means computer readable program code for transferring the temporarily stored 
traffic data to the database sorts the temporarily stored traffic data temporarily stored in the 
buffer means before transferring the traffic data to the database. 
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41 

^TT (Currently Amended) The system article of manufacture o f claim 40 3 wherein the 
processing means computer read a ble program code for processing hits logged in each log file 
further comprises log parser means computer readable program code for reading log lines in the 
log files* and for separating each log line into individual fields. 

So t\<\ 

-48: (Currendy Amended) The system article of manufacture of claims/', further 
comprising computer readable pr ogram code for generating reports using the associated traffic 
data stored in the database wherein the log parser means processes the log lines in real time as 
each hit is logged to a log file . 

S\ 

(Currently Amended) The system article of manufacture of claim 40, wherein the 
processing means computer rea d able prog r am code for processing hits logged in each log file 
processes hits originating from multiple internet sites and logged to a single log file. 

(Currently Amended) The system article of manufacture of claim 40, wherein the 
processing means computer rea d able prog r am code for processing hits logged in each log file 
comprises website identification means that identifies computer readable program code for 
identifying a source of each hit. 
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**5^* (Currently Amended) The system article of manufacture of claim 42, wherein the 



processing means computer readable program code for processing hits logged in each log file 



comprises visitor identification means that determines computer readable program code for 
determining if a hit originates from a visitor with a preexisting visitor record in the database. 



(Currently Amended) The system article of manufacture of clairr^Sf, wherein the 
visitor identification means computer readable program code for determining if a hit originates 
from a visitor with a preexisting visitor record in the database creates a new visitor record if a hit 
originates from a visitor without a preexisting visitor record in the database. 

53. (Currently Amended) The system article of manufacture of claim 40, wherein the 
processing means computer readable program code for processing hits logged in each log file 
comprises domain name system (DNS) rcsolvcr means that determines computer readable 
program code for determining host and domain information for each visitor. 

54. (Currently Amended) The system article of manufacture of claim 53, wherein the 
DNS resolver means computer readable program code for determining host and domain 
information for each visitor utilizes reverse DNS resolution to determine the host and domain 
information for each visitor. 
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-53* (Currently Amended) A system for analyzing and monitoring internet traffic 
generated by visitors to at least one internet site hosted by at least one internet server, 
comprising: 

a database; 

a log engine that receives log files from the at least one internet server, processes 
hits logged in each log file, and stores traffic data extracted from the processed hits in the 
database, wherein the log engine comprises, 

a database buffer that temporarily stores traffic data received from the 

database, 

a log parser that processes each hit in each log file, and separates each hit 
into its individual fields, wherein the log parser, when new log file data is present in the log file, 
processes said new log file data and determines an "end of file" location on the log file, and, 
when new log file data is not present in the log file, periodically checks the log file at 
predetermined time periods to check for new log file data, and commences processing of any 
new log file data at a most recent determined "end of file" location . 

a visitor identifier that receives each hit's individual fields from the log 
parser, identifies each hit as originating from either a new visitor or an existing visitor, and 
creates a new visitor record in the database buffer if a hit originates from a new visitor, 
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a buffer updater that, prior to processing a new log file, copies previously 
stored data from the database to the database buffer, and wherein, for each hit, the buffer 
updater locates in the database buffer the visitor record identified or created by the visitor 
identifier for a respective hit, and updates the identified or created visitor record in the database 
buffer with traffic data derived from the respective hit, and 

a database updater that copies updated traffic data from the database 
buffer to the database after all hits in the new log file have been processed; and 

a report engine that generates reports using the traffic data stored in the 

database. 



56. (Canceled) 



J&K (Original) The system of claim 55, wherein the log engine further comprises a 
website identifier that identifies a source of each hit. 

si 

^5#T (Original) The system of chsmjff^ wherein the website identifier identifies the 
source of each hit from website identifier text received from the log parser for each hit. 
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(Original) The system of claim 55, wherein the log engine further comprises a 
domain name system (DNS) resolver that determines host and domain information for each 
visitor to an internet site. 

& St 

(Original) The system of claim £9f wherein the DNS resolver is adapted to process 
multiple DNS queries in parallel. 

ftf (Original) The system of claim 55, wherein the log engine is adapted to process e- 
commerce log files that contain information on money spent by the visitor. 

^£2^ (Currendy Amended) A method of analyzing and monitoring internet traffic 
generated by visitors to at least one internet site hosted by at least one internet server, 
comprising the steps of: 

receiving log files from the at least one internet server; 

processing hits logged in each log file , as each hit is logged to each log file, by: 

(a) processing new hits present in a log file, 

(b) determining an "end of file" location on the log file, 

(c) waiting for a predetermined time period if no new hits are present in the 

log file. 
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(d) checking for new hits in the log file after the predetermined time 

period, and 

(e) proc essing any new hits discovered in the log file by starting at the 
determined end of file location in the log file : 

storing, in a database, traffic data derived from the hits; and 
associating the traffic data derived from the hits and stored in the database with a 
visitor that generated the hit. 

(Original) The method of claim J>2f further comprising the step of generating 
reports using the associated traffic data stored in the database. 

(Original) The method of claim,#5f wherein the traffic data derived from the hits 
is stored in a plurality of hash tables. 

pf. (Original) The method of claim^C wherein traffic information derived from the 
hits are stored in a visitor hash table that contains a unique visitor record for each visitor, and 
wherein data related to at least one non-unique parameter is stored in respective data tables. 
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M. (Original) The method of claim 65; wherein the visitor hash table comprises at 
least one pointer that points to at least one record stored in at least one of the data tables. 

67. (Original) The method of claim^ further comprising the step of temporarily 
storing the traffic data derived from the hits in a buffer prior to storing the traffic data in the 
database. 



68. (Original) The method of claim 67, further comprising the step of sorting the 
traffic data stored in the buffer prior to storing the traffic data in the database. 

69. (Original) The method of claim^ wherein the step of processing hits logged in 
each log file comprises the steps of: 

reading log lines in the log files; and 
separating each log line into individual fields. 

70. (Original) The method of claim 69, wherein the hits logged in each log file are 
processed in real time as each hit is logged to a log file. 



(Canceled) 
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fa. (Original) The method of claim^pgf further comprising the step of identifying a 
source from which each hit originates. 

(Original) The method of claim^f*^ further comprising the steps of: 
determining if a hit originates from a visitor with a preexisting visitor record in the 

database; and 

creating a new visitor record if the hit originates from a visitor without a 
preexisting visitor record in the database. 

(Original) The method of claknjS2f further comprising the step of determining 
host and domain information for each visitor. 

(Original) The method of clairn^ wherein host and domain information for each 
visitor is determined using reverse domain name system (DNS) resolution. 

^(f (Currently Amended) A method of processing a log file to obtain traffic data, 
comprising the steps of: 

copying previously stored traffic data from a database to a database buffer; 
separating hits logged in the log file into individual fields , wherein each hit is 
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processed as it is logged to the log file by: 

(a) processing new hits present in the log file. 

(b) determining an "end of file" location in the log file. 

(c) waiting for a predetermined time period if no new hits are present in the 

log file. 

(d) checking for new hits in the log file after the predetermined time 

period, 

(e) processing any new hits discovered in the log file by starting at the end 
of file location in the log file, and 

(f) repeating steps (a) - (e) ; 

identifying each hit as originating from either a new visitor or an existing visitor; 
creating a new visitor record in the database buffer if a hit originates from a new 

visitor; 

for each hit, locating the visitor record identified or created and updating the 
identified or created visitor record in the database buffer with traffic data derived from the 
respective hit; and 

copying updated traffic data from the database buffer to the database after all hits 
in the log file have been processed. 
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(Original) The method of claim^^further comprising the step of generating a 
report based on the traffic data in the database. 



p. (Canceled) 

Jtf (Original) The method of claim^ wherein hits originating from multiple sources 
are logged to the log file. 

ptf. (Original) The method of claim,^ further comprising the step of identifying a 
source from which each hit originates. 

^1 . (Original) The method of claim^?< further comprising the step of determining 
host and domain information for each visitor. 

^ .. 1* 

£2. (Original) The method of clairn^f, wherein host and domain information for each 
visitor is determined using reverse domain name system (DNS) resolution. 
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